@beezping/adapter-prisma 0.7.0 → 0.8.0

package/dist/index.js

@@ -1,3 +1,23 @@
+// ../core/src/concurrency.ts
+async function settleWithConcurrencyLimit(items, concurrency, task) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const runWorker = async () => {
+    while (nextIndex < items.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      try {
+        results[index] = { status: "fulfilled", value: await task(items[index]) };
+      } catch (error) {
+        results[index] = { status: "rejected", reason: error };
+      }
+    }
+  };
+  const workerCount = Math.min(Math.max(1, concurrency), items.length);
+  await Promise.all(Array.from({ length: workerCount }, runWorker));
+  return results;
+}
+
 // ../core/src/filters.ts
 var DEFAULT_PAGE_LIMIT = 50;
 var MAX_PAGE_LIMIT = 100;
@@ -22,6 +42,7 @@ function hasOwn(value, key) {
 }
 
 // ../core/src/types.ts
+var MAX_COMMENTS_PER_FEEDBACK = 100;
 var StoreNotFoundError = class extends Error {
   code = "STORE_NOT_FOUND";
   constructor(message = "Record not found", options) {
@@ -43,6 +64,20 @@ var StorePersistenceError = class extends Error {
     this.name = "StorePersistenceError";
   }
 };
+var StoreLimitError = class extends Error {
+  code = "STORE_LIMIT";
+  constructor(message = "Store limit reached", options) {
+    super(message, options);
+    this.name = "StoreLimitError";
+  }
+};
+var StoreValueTooLongError = class extends Error {
+  code = "STORE_VALUE_TOO_LONG";
+  constructor(message = "Value too long for the store", options) {
+    super(message, options);
+    this.name = "StoreValueTooLongError";
+  }
+};
 function hasErrorCode(error, code) {
   return hasOwn(error, "code") && error.code === code;
 }
@@ -82,826 +117,22 @@ function flattenAnnotation(ann) {
   };
 }
 
-// ../server/dist/index.js
-import * as zod from "zod";
-var MAX_ANNOTATIONS_PER_FEEDBACK = 50;
-var MAX_LOGGED_ORIGIN_LENGTH = 128;
-var MAX_REPORTED_HEADER_NAME_LENGTH = 64;
-var SITEPING_ERROR_MESSAGES = {
-  invalidJson: "Invalid JSON",
-  unauthorized: "Unauthorized",
-  apiKeyRequiredForDestructive: "apiKey required for destructive operations",
-  forbidden: "Forbidden",
-  unsupportedMediaType: "Content-Type must be application/json",
-  feedbackNotFound: "Feedback not found",
-  clientIdUsedByAnotherProject: "clientId already used by another project",
-  tooManyAnnotations: `Too many annotations (max ${MAX_ANNOTATIONS_PER_FEEDBACK})`,
-  deletionAborted: "Deletion aborted: a linked resource could not be cleaned up",
-  internalServerError: "Internal server error"
-};
-var SITEPING_CONFIGURATION_ERROR_MESSAGES = {
-  ownershipVerificationRequired: "[siteping] createSitepingHandler: `access.authorize` needs a store implementing `verifyProjectOwnership`. Without it, a caller authorized for one project could PATCH or DELETE another project's feedback by id. Implement `verifyProjectOwnership` on the store (createCollectionStore and PrismaStore already do).",
-  invalidAllowedHeader: "[siteping] allowedHeaders: every entry must be a valid HTTP header name (letters, digits and !#$%&'*+-.^_`|~, no spaces or commas). Invalid entry:"
-};
-function accessGateFromControl(access) {
-  return {
-    echoesAuthorEmailOnCreate: false,
-    async authenticate(request) {
-      const principal = await access.authenticate(request);
-      if (principal === null) return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.unauthorized };
-      return { ok: true, principal, canReadAuthorEmail: access.canReadAuthorEmail?.(principal) ?? true };
-    },
-    async authorize(context) {
-      return access.authorize ? access.authorize(context) : true;
-    }
-  };
-}
-var textEncoder = new TextEncoder();
-function constantTimeEqual(received, expected) {
-  const receivedBytes = textEncoder.encode(received);
-  const expectedBytes = textEncoder.encode(expected);
-  if (receivedBytes.length !== expectedBytes.length) return false;
-  let difference = 0;
-  for (let index = 0; index < receivedBytes.length; index++) {
-    difference |= (receivedBytes[index] ?? 0) ^ (expectedBytes[index] ?? 0);
-  }
-  return difference === 0;
-}
-function isProductionEnvironment() {
-  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
-}
-function createApiKeyGate({
-  apiKey,
-  publicEndpoints = apiKey ? ["POST", "OPTIONS"] : void 0,
-  requireAuthForDestructive = true,
-  redactUnauthenticatedEmails = true
-}) {
-  if (!apiKey && requireAuthForDestructive && isProductionEnvironment()) {
-    throw new Error(
-      "[siteping] createSitepingHandler: apiKey is required in production. Set `apiKey` to enable destructive endpoints, pass `access` to plug your own auth, or pass `requireAuthForDestructive: false` if SitePing sits behind your own auth middleware."
-    );
-  }
-  const publicMethods = publicEndpoints ? new Set(publicEndpoints) : null;
-  const isBearerAuthenticated = (request) => {
-    if (!apiKey) return false;
-    const header = request.headers.get("Authorization");
-    return header !== null && constantTimeEqual(header, `Bearer ${apiKey}`);
-  };
-  return {
-    // Legacy contract: a successful POST echoes the email back to its author.
-    echoesAuthorEmailOnCreate: true,
-    async authenticate(request, method) {
-      const canReadAuthorEmail = !redactUnauthenticatedEmails || isBearerAuthenticated(request);
-      if (!apiKey) {
-        if (requireAuthForDestructive && (method === "DELETE" || method === "PATCH")) {
-          return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.apiKeyRequiredForDestructive };
-        }
-        return { ok: true, principal: null, canReadAuthorEmail };
-      }
-      if (publicMethods?.has(method) || isBearerAuthenticated(request)) {
-        return { ok: true, principal: null, canReadAuthorEmail };
-      }
-      return { ok: false, status: 401, error: SITEPING_ERROR_MESSAGES.unauthorized };
-    },
-    async authorize() {
-      return true;
-    }
-  };
-}
-var LIST_CACHE_CONTROL = "no-store";
-var CSRF_PROTECTED_METHODS = ["POST", "PATCH", "DELETE"];
-var JSON_MEDIA_TYPE = "application/json";
-var CORS_ALLOWED_METHODS = "GET, POST, PATCH, DELETE, OPTIONS";
-var CORS_DEFAULT_ALLOWED_HEADERS = ["Content-Type", "Authorization"];
-var HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-var CORS_MAX_AGE_SECONDS = 86400;
-var LIST_QUERY_KEYS = [
-  "projectName",
-  "page",
-  "limit",
-  "type",
-  "status",
-  "statuses",
-  "search",
-  "url",
-  "urlPattern"
-];
-function resolveAllowedHeaders(extraHeaders) {
-  const headersByLowercaseName = /* @__PURE__ */ new Map();
-  for (const header of [...CORS_DEFAULT_ALLOWED_HEADERS, ...extraHeaders ?? []]) {
-    if (typeof header !== "string" || !HTTP_HEADER_NAME_PATTERN.test(header)) {
-      const reported = String(header).slice(0, MAX_REPORTED_HEADER_NAME_LENGTH);
-      throw new Error(`${SITEPING_CONFIGURATION_ERROR_MESSAGES.invalidAllowedHeader} ${JSON.stringify(reported)}`);
-    }
-    const lowercaseName = header.toLowerCase();
-    if (!headersByLowercaseName.has(lowercaseName)) headersByLowercaseName.set(lowercaseName, header);
-  }
-  return [...headersByLowercaseName.values()].join(", ");
-}
-function createCorsPolicy({ allowedOrigins, allowedHeaders, allowedMethods }) {
-  return { allowedOrigins, allowedMethods, allowedHeaders: resolveAllowedHeaders(allowedHeaders) };
-}
-function buildCorsHeaders(request, policy) {
-  if (!policy.allowedOrigins) return {};
-  const origin = request.headers.get("Origin");
-  if (!origin || !policy.allowedOrigins.includes(origin)) return {};
-  return {
-    "Access-Control-Allow-Origin": origin,
-    "Access-Control-Allow-Methods": policy.allowedMethods,
-    "Access-Control-Allow-Headers": policy.allowedHeaders,
-    "Access-Control-Allow-Credentials": "true",
-    "Access-Control-Max-Age": String(CORS_MAX_AGE_SECONDS),
-    Vary: "Origin"
-  };
-}
-function preflightResponse(request, policy) {
-  return new Response(null, { status: 204, headers: buildCorsHeaders(request, policy) });
-}
-function withCors(response, corsHeaders) {
-  for (const [key, value] of Object.entries(corsHeaders)) {
-    response.headers.set(key, value);
-  }
-  return response;
-}
-var defaultLogger = {
-  error(message, context) {
-    console.error(message, context);
-  }
-};
-function internalErrorResponse({
-  logger,
-  describeError,
-  source,
-  operation,
-  request,
-  corsHeaders,
-  headers,
-  failure
-}) {
-  logger.error(`[siteping] ${source}: ${operation} failed`, {
-    error: failure,
-    method: request.method,
-    path: new URL(request.url).pathname
-  });
-  const message = describeError?.(failure) ?? SITEPING_ERROR_MESSAGES.internalServerError;
-  return withCors(Response.json({ error: message }, { status: 500, ...headers ? { headers } : {} }), corsHeaders);
-}
-var EMAIL_PATTERN = /^(?!\.)(?!.*\.\.)[\p{L}\p{N}!#$%&'*+/=?^_`{|}~.-]{0,63}[\p{L}\p{N}!#$%&'*+/=?^_`{|}~-]@(?:[\p{L}\p{N}](?:[\p{L}\p{N}-]{0,61}[\p{L}\p{N}])?\.)+[\p{L}\p{N}-]{2,63}$/u;
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-function hasOwn2(value, key) {
-  return isRecord2(value) && key in value;
-}
-var FEEDBACK_TYPES2 = ["question", "change", "bug", "other"];
-var FEEDBACK_STATUSES2 = ["open", "in_progress", "resolved", "wont_fix"];
-var CLOSED_FEEDBACK_STATUSES2 = ["resolved", "wont_fix"];
-function isClosedStatus2(status) {
-  return CLOSED_FEEDBACK_STATUSES2.includes(status);
-}
-function toFeedbackUpdate2(status, closedAt = /* @__PURE__ */ new Date()) {
-  return isClosedStatus2(status) ? { status, resolvedAt: closedAt } : { status, resolvedAt: null };
-}
-var StoreNotFoundError2 = class extends Error {
-  code = "STORE_NOT_FOUND";
-  constructor(message = "Record not found", options) {
-    super(message, options);
-    this.name = "StoreNotFoundError";
-  }
-};
-var StoreDuplicateError2 = class extends Error {
-  code = "STORE_DUPLICATE";
-  constructor(message = "Duplicate record", options) {
-    super(message, options);
-    this.name = "StoreDuplicateError";
-  }
-};
-function hasErrorCode2(error, code) {
-  return hasOwn2(error, "code") && error.code === code;
-}
-function isStoreNotFound2(error) {
-  if (error instanceof StoreNotFoundError2) return true;
-  return hasErrorCode2(error, "STORE_NOT_FOUND") || hasErrorCode2(error, "P2025");
-}
-function isStoreDuplicate2(error) {
-  if (error instanceof StoreDuplicateError2) return true;
-  return hasErrorCode2(error, "STORE_DUPLICATE") || hasErrorCode2(error, "P2002");
-}
-function flattenAnnotation2(ann) {
-  return {
-    cssSelector: ann.anchor.cssSelector,
-    xpath: ann.anchor.xpath,
-    textSnippet: ann.anchor.textSnippet,
-    elementTag: ann.anchor.elementTag,
-    elementId: ann.anchor.elementId,
-    textPrefix: ann.anchor.textPrefix,
-    textSuffix: ann.anchor.textSuffix,
-    fingerprint: ann.anchor.fingerprint,
-    neighborText: ann.anchor.neighborText,
-    anchorKey: ann.anchor.anchorKey ?? null,
-    xPct: ann.rect.xPct,
-    yPct: ann.rect.yPct,
-    wPct: ann.rect.wPct,
-    hPct: ann.rect.hPct,
-    scrollX: ann.scrollX,
-    scrollY: ann.scrollY,
-    viewportW: ann.viewportW,
-    viewportH: ann.viewportH,
-    devicePixelRatio: ann.devicePixelRatio
-  };
-}
-var CONSOLE_DIAGNOSTIC_LEVELS2 = ["log", "info", "warn", "error"];
-var z2 = "z" in zod ? zod.z : zod;
-var anchorSchema = z2.object({
-  cssSelector: z2.string().min(1).max(2e3),
-  xpath: z2.string().min(1).max(2e3),
-  textSnippet: z2.string().max(500),
-  elementTag: z2.string().min(1),
-  elementId: z2.string().optional(),
-  textPrefix: z2.string().max(200),
-  textSuffix: z2.string().max(200),
-  fingerprint: z2.string().max(200),
-  neighborText: z2.string().max(500),
-  // Optional semantic anchor identifier from `data-feedback-anchor`.
-  // Null when no semantic ancestor exists; widget always sends this field.
-  anchorKey: z2.string().max(200).nullable().optional()
-});
-var rectSchema = z2.object({
-  xPct: z2.number().min(0).max(1),
-  yPct: z2.number().min(0).max(1),
-  wPct: z2.number().min(0).max(1),
-  hPct: z2.number().min(0).max(1)
-});
-var annotationSchema = z2.object({
-  anchor: anchorSchema,
-  rect: rectSchema,
-  scrollX: z2.number().min(0),
-  scrollY: z2.number().min(0),
-  viewportW: z2.number().int().positive(),
-  viewportH: z2.number().int().positive(),
-  devicePixelRatio: z2.number().positive().default(1)
-});
-var consoleEntrySchema = z2.object({
-  level: z2.enum(CONSOLE_DIAGNOSTIC_LEVELS2),
-  timestamp: z2.string().max(50),
-  message: z2.string().max(600)
-});
-var networkEntrySchema = z2.object({
-  url: z2.string().max(2e3),
-  method: z2.string().max(20),
-  status: z2.number().int().min(0).max(599),
-  durationMs: z2.number().min(0).max(6e5),
-  timestamp: z2.string().max(50)
-});
-var diagnosticsSchema = z2.object({
-  console: z2.array(consoleEntrySchema).max(50),
-  network: z2.array(networkEntrySchema).max(20)
-});
-var screenshotRegionSchema = z2.strictObject({
-  xPct: z2.number().min(0).max(1),
-  yPct: z2.number().min(0).max(1),
-  wPct: z2.number().min(0).max(1),
-  hPct: z2.number().min(0).max(1)
-});
-var feedbackCreateSchema = z2.object({
-  projectName: z2.string().min(1).max(200),
-  type: z2.enum(FEEDBACK_TYPES2),
-  message: z2.string().min(1).max(5e3),
-  // Page-scope identifier the widget uses to group feedbacks. Defaults to
-  // `window.location.pathname` ("/orders/42"), but hosts can override
-  // `getPageScope()` to return a full URL, an opaque slug, anything they
-  // want. We trim + require non-empty so whitespace-only payloads don't
-  // leak into the DB; otherwise the value is opaque to the server and only
-  // used as a literal Prisma equality filter, so the loose shape is safe.
-  url: z2.string().trim().min(1).max(2e3),
-  // Optional parameterized URL template (e.g. "/orders/:orderId") provided
-  // by the host via `getPageScope()`. Null when host omits it.
-  urlPattern: z2.string().max(2e3).nullable().optional(),
-  viewport: z2.string().min(1).max(50),
-  userAgent: z2.string().min(1).max(500),
-  authorName: z2.string().min(1).max(200),
-  // The widget's identity modal validates against the same core pattern, so
-  // an address the modal accepts (and persists) is never a 400 here.
-  authorEmail: z2.email({ pattern: EMAIL_PATTERN }).max(200),
-  annotations: z2.array(annotationSchema).max(50),
-  // Restrict to URL-safe identifiers. The widget generates UUIDs (or a
-  // Date+Math.random fallback), both of which match. Anything outside this
-  // alphabet — `..`, `/`, NUL, etc. — would be a path-traversal vector once
-  // the adapter forwards clientId to `screenshotStorage.upload({ feedbackId })`
-  // (e.g. an S3 key prefix or a local FS path).
-  clientId: z2.string().min(1).max(200).regex(/^[a-zA-Z0-9_-]+$/, "clientId must be alphanumeric (a-z, A-Z, 0-9, _, -)"),
-  // Optional base64 JPEG data URL captured by the widget when
-  // `enableScreenshot: true`. ~1.5 MB cap = roughly a 1.1 MB JPEG, well
-  // above typical sizes (the widget downscales to 1200px). Rejects abuse
-  // without truncating legitimate captures.
-  screenshotDataUrl: z2.string().max(15e5).regex(/^data:image\/(jpeg|png|webp);base64,/, "screenshotDataUrl must be a data:image/* base64 URL").nullable().optional(),
-  // Optional annotation-rect position within the screenshot. Sent by widgets
-  // that capture context around the drawn rect; null + omitted are both
-  // accepted so legacy clients (and captures without a screenshot) keep
-  // working unchanged.
-  screenshotRegion: screenshotRegionSchema.nullable().optional(),
-  // Optional console + failed-network snapshot. The widget only attaches
-  // this when `captureDiagnostics` is enabled; null + omitted are both
-  // accepted so existing clients keep working unchanged.
-  diagnostics: diagnosticsSchema.nullable().optional()
-});
-var feedbackPatchSchema = z2.object({
-  id: z2.string().min(1),
-  projectName: z2.string().min(1).max(200),
-  status: z2.enum(FEEDBACK_STATUSES2)
-});
-var feedbackDeleteSchema = z2.union([
-  z2.object({ id: z2.string().min(1), projectName: z2.string().min(1).max(200) }),
-  z2.object({ projectName: z2.string().min(1).max(200), deleteAll: z2.literal(true) })
-]);
-var getQuerySchema = z2.object({
-  projectName: z2.string().min(1).max(200),
-  page: z2.coerce.number().int().min(1).default(1),
-  limit: z2.coerce.number().int().min(1).max(100).default(50),
-  type: z2.enum(FEEDBACK_TYPES2).optional(),
-  status: z2.enum(FEEDBACK_STATUSES2).optional(),
-  // Bucket status filter serialized as CSV over the wire (e.g.
-  // `statuses=open,in_progress`). Non-empty strings are split before each value
-  // is validated against the known statuses; `statuses` wins over the exact
-  // `status` filter downstream. Capped at 4 — the number of known statuses.
-  statuses: z2.preprocess(
-    (val) => typeof val === "string" && val.length > 0 ? val.split(",") : val,
-    z2.array(z2.enum(FEEDBACK_STATUSES2)).max(4)
-  ).optional(),
-  search: z2.string().max(200).optional(),
-  // Page scope filters — used by the panel's "this page / this type" controls
-  url: z2.string().max(2e3).optional(),
-  urlPattern: z2.string().max(2e3).optional()
-});
-function formatValidationErrors(error) {
-  return error.issues.map((issue) => ({
-    field: issue.path.map(String).join("."),
-    message: issue.message
-  }));
-}
-var DEFAULT_TIMEOUT_MS = 5e3;
-var DISCORD_COLORS = {
-  bug: 15680580,
-  question: 3900150,
-  change: 16096779,
-  other: 7041664
-};
-var DEFAULT_DISCORD_COLOR = 7041664;
-function truncate(text, max = 300) {
-  if (text.length <= max) return text;
-  return `${text.slice(0, max - 1)}\u2026`;
-}
-var SLACK_HEADER_MAX = 150;
-function escapeSlackText(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function buildSlackPayload(feedback) {
-  const preview = escapeSlackText(truncate(feedback.message));
-  const author = escapeSlackText(feedback.authorName);
-  const headline = `New ${feedback.type} feedback from ${feedback.authorName}`;
-  return {
-    text: `${escapeSlackText(headline)}: ${preview}`,
-    blocks: [
-      {
-        type: "header",
-        text: { type: "plain_text", text: truncate(headline, SLACK_HEADER_MAX), emoji: true }
-      },
-      {
-        type: "section",
-        text: { type: "mrkdwn", text: preview }
-      },
-      {
-        type: "context",
-        elements: [
-          { type: "mrkdwn", text: `*Project:* ${escapeSlackText(feedback.projectName)}` },
-          { type: "mrkdwn", text: `*Type:* ${feedback.type}` },
-          { type: "mrkdwn", text: `*URL:* ${escapeSlackText(feedback.url)}` },
-          { type: "mrkdwn", text: `*From:* ${author} (${escapeSlackText(feedback.authorEmail)})` }
-        ]
-      }
-    ]
-  };
-}
-function buildDiscordPayload(feedback) {
-  const preview = truncate(feedback.message);
-  return {
-    content: `New **${feedback.type}** feedback from **${feedback.authorName}**`,
-    embeds: [
-      {
-        title: `${feedback.type} \u2014 ${feedback.projectName}`,
-        description: preview,
-        color: DISCORD_COLORS[feedback.type] ?? DEFAULT_DISCORD_COLOR,
-        fields: [
-          { name: "URL", value: feedback.url, inline: false },
-          { name: "Author", value: `${feedback.authorName} (${feedback.authorEmail})`, inline: true },
-          { name: "Viewport", value: feedback.viewport, inline: true }
-        ],
-        timestamp: new Date(feedback.createdAt).toISOString()
-      }
-    ],
-    allowed_mentions: { parse: [] }
-  };
-}
-function buildGenericPayload(feedback) {
-  const { clientId: _clientId, ...payload } = feedback;
-  return payload;
-}
-function buildWebhookPayload(type, feedback) {
-  switch (type) {
-    case "slack":
-      return buildSlackPayload(feedback);
-    case "discord":
-      return buildDiscordPayload(feedback);
-    default:
-      return buildGenericPayload(feedback);
-  }
-}
-async function dispatchWebhook(config, feedback) {
-  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const body = JSON.stringify(buildWebhookPayload(config.type ?? "generic", feedback));
-  const headers = { "Content-Type": "application/json", ...config.headers ?? {} };
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetch(config.url, {
-      method: "POST",
-      headers,
-      body,
-      signal: controller.signal
-    });
-    clearTimeout(timer);
-    if (!response.ok) {
-      const err = new Error(`Webhook responded with HTTP ${response.status}`);
-      reportError(config, err, feedback.id);
-    }
-  } catch (rawError) {
-    clearTimeout(timer);
-    const err = rawError instanceof Error ? rawError : new Error(String(rawError));
-    reportError(config, err, feedback.id);
-  }
-}
-function reportError(config, err, feedbackId) {
-  if (config.onError) {
-    try {
-      config.onError(err, feedbackId);
-    } catch (callbackErr) {
-      console.warn(
-        `[siteping] webhook onError() callback threw for feedback ${feedbackId}: ${String(callbackErr)} (original error: ${err.message})`
-      );
-    }
-    return;
-  }
-  console.warn(`[siteping] webhook to ${config.url} failed for feedback ${feedbackId}: ${err.message}`);
-}
-async function dispatchWebhooks(configs, feedback) {
-  if (configs.length === 0) return;
-  await Promise.all(configs.map((c) => dispatchWebhook(c, feedback)));
-}
-function toCreateInput(payload) {
-  return {
-    projectName: payload.projectName,
-    type: payload.type,
-    message: payload.message,
-    status: "open",
-    url: payload.url,
-    urlPattern: payload.urlPattern ?? null,
-    viewport: payload.viewport,
-    userAgent: payload.userAgent,
-    authorName: payload.authorName,
-    authorEmail: payload.authorEmail,
-    clientId: payload.clientId,
-    annotations: payload.annotations.map(flattenAnnotation2),
-    screenshotDataUrl: payload.screenshotDataUrl ?? null,
-    screenshotRegion: payload.screenshotRegion ?? null,
-    diagnostics: payload.diagnostics ?? null
-  };
-}
-function createFeedbackOperation({
-  store,
-  pipeline,
-  beforeCreate,
-  onCreated,
-  webhooks
-}) {
-  const respondCreated = (scope, feedback, projectName) => feedback.projectName === projectName ? pipeline.json(scope, pipeline.presentCreated(scope, feedback), { status: 201 }) : pipeline.error(scope, 409, SITEPING_ERROR_MESSAGES.clientIdUsedByAnotherProject);
-  const insert = async (input) => {
-    try {
-      if (store.createFeedbackIfAbsent) {
-        const { feedback, created } = await store.createFeedbackIfAbsent(input);
-        return { feedback, isNew: created };
-      }
-      return { feedback: await store.createFeedback(input), isNew: true };
-    } catch (error) {
-      if (isStoreDuplicate2(error)) {
-        const existing = await store.findByClientId(input.clientId);
-        if (existing) return { feedback: existing, isNew: false };
-      }
-      throw error;
-    }
-  };
-  return async (request) => {
-    const authentication = await pipeline.authenticate(request, "POST");
-    if (!authentication.ok) return authentication.response;
-    const scope = authentication.value;
-    const payload = await pipeline.readBody(scope, feedbackCreateSchema);
-    if (!payload.ok) return payload.response;
-    if (payload.value.annotations.length > MAX_ANNOTATIONS_PER_FEEDBACK) {
-      return pipeline.error(scope, 400, SITEPING_ERROR_MESSAGES.tooManyAnnotations);
-    }
-    try {
-      const validatedInput = toCreateInput(payload.value);
-      const input = beforeCreate ? await beforeCreate(validatedInput, scope.context) : validatedInput;
-      const refusal = await pipeline.authorize(scope, { action: "create", projectName: input.projectName });
-      if (refusal) return refusal;
-      const replayed = await store.findByClientId(input.clientId);
-      if (replayed) return respondCreated(scope, replayed, input.projectName);
-      const { feedback, isNew } = await insert(input);
-      if (isNew && feedback.projectName === input.projectName) {
-        if (webhooks.length > 0) void dispatchWebhooks(webhooks, feedback);
-        if (onCreated) await pipeline.runHook("onCreated", () => onCreated(feedback, scope.context));
-      }
-      return respondCreated(scope, feedback, input.projectName);
-    } catch (error) {
-      return pipeline.internalError(scope, "create feedback", error);
-    }
-  };
-}
-function toDeletionTarget(deletion) {
-  return "deleteAll" in deletion ? { kind: "project", projectName: deletion.projectName } : { kind: "single", id: deletion.id, projectName: deletion.projectName };
-}
-function deleteFeedbackOperation({
-  store,
-  pipeline,
-  onDeleting,
-  onDeleted
-}) {
-  const removeTarget = (target) => target.kind === "project" ? store.deleteAllFeedbacks(target.projectName) : store.deleteFeedback(target.id);
-  return async (request) => {
-    const authentication = await pipeline.authenticate(request, "DELETE");
-    if (!authentication.ok) return authentication.response;
-    const scope = authentication.value;
-    const payload = await pipeline.readBody(scope, feedbackDeleteSchema);
-    if (!payload.ok) return payload.response;
-    const target = toDeletionTarget(payload.value);
-    try {
-      const refusal = await pipeline.authorize(
-        scope,
-        target.kind === "project" ? { action: "deleteAll", projectName: target.projectName } : { action: "delete", projectName: target.projectName, feedbackId: target.id }
-      );
-      if (refusal) return refusal;
-      if (target.kind === "single" && store.verifyProjectOwnership && !await store.verifyProjectOwnership(target.id, target.projectName)) {
-        return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
-      }
-      if (onDeleting) {
-        try {
-          await onDeleting(target, scope.context);
-        } catch (error) {
-          pipeline.logger.error("[siteping] createSitepingHandler: hook onDeleting aborted the deletion", {
-            error,
-            target
-          });
-          return pipeline.error(scope, 502, SITEPING_ERROR_MESSAGES.deletionAborted);
-        }
-      }
-      await removeTarget(target);
-      if (onDeleted) await pipeline.runHook("onDeleted", () => onDeleted(target, scope.context));
-      return pipeline.json(scope, { deleted: true });
-    } catch (error) {
-      if (isStoreNotFound2(error)) return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
-      return pipeline.internalError(scope, "delete feedback", error);
-    }
-  };
-}
-function readListQuery(request) {
-  const searchParams = new URL(request.url).searchParams;
-  const rawQuery = {};
-  for (const key of LIST_QUERY_KEYS) {
-    const value = searchParams.get(key);
-    if (value !== null) rawQuery[key] = value;
-  }
-  return rawQuery;
-}
-function listFeedbacksOperation({ store, pipeline }) {
-  return async (request) => {
-    const authentication = await pipeline.authenticate(request, "GET");
-    if (!authentication.ok) return authentication.response;
-    const scope = authentication.value;
-    const query = pipeline.validate(scope, getQuerySchema, readListQuery(request));
-    if (!query.ok) return query.response;
-    try {
-      const refusal = await pipeline.authorize(scope, { action: "list", projectName: query.value.projectName });
-      if (refusal) return refusal;
-      const page = await store.getFeedbacks(query.value);
-      return pipeline.json(
-        scope,
-        { ...page, feedbacks: page.feedbacks.map((feedback) => pipeline.present(scope, feedback)) },
-        { headers: { "Cache-Control": LIST_CACHE_CONTROL } }
-      );
-    } catch (error) {
-      return pipeline.internalError(scope, "list feedbacks", error);
-    }
-  };
-}
-function updateFeedbackOperation({
-  store,
-  pipeline,
-  onUpdated
-}) {
-  return async (request) => {
-    const authentication = await pipeline.authenticate(request, "PATCH");
-    if (!authentication.ok) return authentication.response;
-    const scope = authentication.value;
-    const payload = await pipeline.readBody(scope, feedbackPatchSchema);
-    if (!payload.ok) return payload.response;
-    const { id, projectName, status } = payload.value;
-    try {
-      const refusal = await pipeline.authorize(scope, { action: "update", projectName, feedbackId: id });
-      if (refusal) return refusal;
-      if (store.verifyProjectOwnership && !await store.verifyProjectOwnership(id, projectName)) {
-        return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
-      }
-      const feedback = await store.updateFeedback(id, toFeedbackUpdate2(status));
-      if (onUpdated) await pipeline.runHook("onUpdated", () => onUpdated(feedback, scope.context));
-      return pipeline.json(scope, pipeline.present(scope, feedback));
-    } catch (error) {
-      if (isStoreNotFound2(error)) return pipeline.error(scope, 404, SITEPING_ERROR_MESSAGES.feedbackNotFound);
-      return pipeline.internalError(scope, "update feedback", error);
-    }
-  };
-}
-function isCsrfProtectedMethod(method) {
-  return CSRF_PROTECTED_METHODS.includes(method);
-}
-function isMutationOriginAllowed(request, policy) {
-  if (!policy.allowedOrigins) return true;
-  const origin = request.headers.get("Origin");
-  if (origin === null) return true;
-  if (policy.allowedOrigins.includes(origin)) return true;
-  return origin === new URL(request.url).origin;
-}
-function hasJsonContentType(request) {
-  const contentType = request.headers.get("Content-Type");
-  if (contentType === null) return false;
-  const [mediaType = ""] = contentType.split(";");
-  return mediaType.trim().toLowerCase() === JSON_MEDIA_TYPE;
-}
-function describeOriginForLog(request) {
-  const origin = request.headers.get("Origin") ?? "";
-  return origin.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, MAX_LOGGED_ORIGIN_LENGTH);
-}
-function toWireFeedback(feedback, includeEmail) {
-  const { clientId: _clientId, ...wire } = feedback;
-  return includeEmail ? wire : { ...wire, authorEmail: "" };
-}
-function createRequestPipeline({
-  gate,
-  corsPolicy,
-  logger,
-  describeError,
-  presentFeedback
-}) {
-  const json = (scope, body, init) => withCors(Response.json(body, init), scope.corsHeaders);
-  const error = (scope, status, message) => json(scope, { error: message }, { status });
-  const validate = (scope, schema, input) => {
-    const parsed = schema.safeParse(input);
-    if (parsed.success) return { ok: true, value: parsed.data };
-    return { ok: false, response: json(scope, { errors: formatValidationErrors(parsed.error) }, { status: 400 }) };
-  };
-  const internalError = (request, corsHeaders, operation, failure) => internalErrorResponse({
-    logger,
-    describeError,
-    source: "createSitepingHandler",
-    operation,
-    request,
-    corsHeaders,
-    failure
-  });
-  const present = (scope, feedback, includeEmail = scope.canReadAuthorEmail) => toWireFeedback(presentFeedback ? presentFeedback(feedback, scope.context) : feedback, includeEmail);
-  return {
-    json,
-    error,
-    /**
-     * Refuse forged mutations, then run the access gate. Mutating methods
-     * from an origin outside `allowedOrigins` answer 403 and non-JSON bodies
-     * 415, before the body is parsed, the caller authenticated or any hook
-     * run (see `request-guards.ts`). A throwing `authenticate` (session store
-     * down…) answers the logged 500 with CORS headers instead of rejecting
-     * the handler, which a browser would only see as an opaque network error.
-     */
-    async authenticate(request, method) {
-      const corsHeaders = buildCorsHeaders(request, corsPolicy);
-      if (isCsrfProtectedMethod(method)) {
-        if (!isMutationOriginAllowed(request, corsPolicy)) {
-          logger.error("[siteping] createSitepingHandler: refused a mutation from an origin outside allowedOrigins", {
-            method,
-            path: new URL(request.url).pathname,
-            origin: describeOriginForLog(request)
-          });
-          return { ok: false, response: error({ corsHeaders }, 403, SITEPING_ERROR_MESSAGES.forbidden) };
-        }
-        if (!hasJsonContentType(request)) {
-          return { ok: false, response: error({ corsHeaders }, 415, SITEPING_ERROR_MESSAGES.unsupportedMediaType) };
-        }
-      }
-      let outcome;
-      try {
-        outcome = await gate.authenticate(request, method);
-      } catch (failure) {
-        return { ok: false, response: internalError(request, corsHeaders, "authenticate request", failure) };
-      }
-      if (!outcome.ok) return { ok: false, response: error({ corsHeaders }, outcome.status, outcome.error) };
-      return {
-        ok: true,
-        value: {
-          context: { request, principal: outcome.principal },
-          canReadAuthorEmail: outcome.canReadAuthorEmail,
-          corsHeaders
-        }
-      };
-    },
-    validate,
-    /** Read and validate a JSON body. */
-    async readBody(scope, schema) {
-      const body = await scope.context.request.json().catch(() => null);
-      if (!body) return { ok: false, response: error(scope, 400, SITEPING_ERROR_MESSAGES.invalidJson) };
-      return validate(scope, schema, body);
-    },
-    /** `null` when allowed, the 403 response otherwise. */
-    async authorize(scope, authorization) {
-      const allowed = await gate.authorize({ ...scope.context, ...authorization });
-      return allowed ? null : error(scope, 403, SITEPING_ERROR_MESSAGES.forbidden);
-    },
-    present,
-    /**
-     * Wire shape of a record answering a `POST` (fresh or replayed): the
-     * requester's email policy, except under a gate that echoes the email to
-     * its submitter (legacy api-key policy).
-     */
-    presentCreated(scope, feedback) {
-      return present(scope, feedback, gate.echoesAuthorEmailOnCreate || scope.canReadAuthorEmail);
-    },
-    /** Log an unexpected failure and answer 500 (with `describeError`'s hint when it has one). */
-    internalError(scope, operation, failure) {
-      return internalError(scope.context.request, scope.corsHeaders, operation, failure);
-    },
-    /** Run a post-write hook; its failure is logged, never surfaced. */
-    async runHook(name, invoke) {
-      try {
-        await invoke();
-      } catch (failure) {
-        logger.error(`[siteping] createSitepingHandler: hook ${name} failed`, { error: failure });
-      }
-    },
-    logger
-  };
-}
-function toWebhookList(webhooks) {
-  if (!webhooks) return [];
-  return Array.isArray(webhooks) ? webhooks : [webhooks];
-}
-function createSitepingHandler(options) {
-  const {
-    store,
-    allowedOrigins,
-    allowedHeaders,
-    beforeCreate,
-    presentFeedback,
-    hooks = {},
-    logger = defaultLogger,
-    describeError
-  } = options;
-  if (!store) {
-    throw new Error("[siteping] createSitepingHandler requires a `store`.");
-  }
-  if (options.access?.authorize && !store.verifyProjectOwnership) {
-    throw new Error(SITEPING_CONFIGURATION_ERROR_MESSAGES.ownershipVerificationRequired);
-  }
-  const corsPolicy = createCorsPolicy({ allowedOrigins, allowedHeaders, allowedMethods: CORS_ALLOWED_METHODS });
-  const gate = options.access ? accessGateFromControl(options.access) : createApiKeyGate(options);
-  const pipeline = createRequestPipeline({ gate, corsPolicy, logger, describeError, presentFeedback });
-  return {
-    /** CORS preflight. Configure `allowedOrigins` (and `allowedHeaders`) for cross-origin widgets. */
-    OPTIONS: (request) => preflightResponse(request, corsPolicy),
-    POST: createFeedbackOperation({
-      store,
-      pipeline,
-      beforeCreate,
-      onCreated: hooks.onCreated?.bind(hooks),
-      webhooks: toWebhookList(options.webhooks)
-    }),
-    GET: listFeedbacksOperation({ store, pipeline }),
-    PATCH: updateFeedbackOperation({ store, pipeline, onUpdated: hooks.onUpdated?.bind(hooks) }),
-    DELETE: deleteFeedbackOperation({
-      store,
-      pipeline,
-      onDeleting: hooks.onDeleting?.bind(hooks),
-      onDeleted: hooks.onDeleted?.bind(hooks)
-    })
-  };
+// ../core/src/screenshot-storage.ts
+var SCREENSHOT_DELETE_CONCURRENCY = 32;
+function screenshotMimeType(dataUrl) {
+  return /^data:(image\/(?:jpeg|png|webp))[;,]/i.exec(dataUrl)?.[1]?.toLowerCase() ?? "image/jpeg";
 }
 
 // src/index.ts
+import {
+  createBeezpingHandler as createServerHandler
+} from "@beezping/server";
+import { dispatchWebhook, dispatchWebhooks } from "@beezping/server";
 var INCLUDE_ANNOTATIONS = { annotations: true };
+var INCLUDE_ANNOTATIONS_AND_COMMENTS = {
+  annotations: true,
+  comments: { orderBy: [{ createdAt: "asc" }, { id: "asc" }] }
+};
 var PROVIDERS_SUPPORTING_INSENSITIVE_MODE = /* @__PURE__ */ new Set([
   "postgresql",
   "postgres",
@@ -926,6 +157,7 @@ function toStoreError(error) {
   if (error instanceof StoreNotFoundError || error instanceof StoreDuplicateError) return error;
   if (isStoreNotFound(error)) return new StoreNotFoundError(void 0, { cause: error });
   if (isStoreDuplicate(error)) return new StoreDuplicateError(void 0, { cause: error });
+  if (hasOwn(error, "code") && error.code === "P2000") return new StoreValueTooLongError(void 0, { cause: error });
   return error;
 }
 function isStoredScreenshotUrl(url) {
@@ -939,9 +171,17 @@ var PrismaStore = class {
   inlineFallbackWarned = false;
   /** @internal */
   caseInsensitiveSearch;
+  /** Read shape of every feedback query — with the thread once the client has the comment model. */
+  include;
   constructor(prisma, options = {}) {
     this.prisma = prisma;
     this.screenshotStorage = options.screenshotStorage;
+    const comments = prisma.beezpingComment;
+    this.include = comments ? INCLUDE_ANNOTATIONS_AND_COMMENTS : INCLUDE_ANNOTATIONS;
+    if (comments) {
+      this.addComment ??= (feedbackId, data) => this.insertComment(comments, feedbackId, data);
+      this.deleteComment ??= (feedbackId, commentId) => this.removeComment(comments, feedbackId, commentId);
+    }
     if (typeof options.caseInsensitiveSearch === "boolean") {
       this.caseInsensitiveSearch = options.caseInsensitiveSearch;
     } else {
@@ -954,12 +194,36 @@ var PrismaStore = class {
     try {
       return await this.insertFeedback(data, screenshotUrl);
     } catch (error) {
-      if (isStoreDuplicate(error)) await this.discardScreenshots([screenshotUrl]);
+      if (isStoreDuplicate(error)) await this.discardUnreferencedUpload(screenshotUrl, data.clientId);
       throw toStoreError(error);
     }
   }
+  /**
+   * Drop the screenshot uploaded by a replay of a stored clientId — unless the
+   * stored row references it. Uploads are keyed on clientId, so with a
+   * deterministic key (`feedback/${feedbackId}.jpg`) the replay wrote to the
+   * very object the existing row points at: deleting it would strip the
+   * surviving feedback of its screenshot. If the lookup itself fails the
+   * object is kept — an orphan beats data loss. Other insert failures never
+   * get here: with such a key, a retry on another instance may have rewritten
+   * the object and not yet inserted the row that will point at it.
+   */
+  async discardUnreferencedUpload(url, clientId) {
+    if (!isStoredScreenshotUrl(url) || !this.screenshotStorage?.delete) return;
+    let existing;
+    try {
+      existing = await this.prisma.beezpingFeedback.findUnique({
+        where: { clientId },
+        select: { screenshotUrl: true }
+      });
+    } catch {
+      return;
+    }
+    if (existing?.screenshotUrl === url) return;
+    await this.discardScreenshots([url]);
+  }
   async insertFeedback(data, screenshotUrl) {
-    return await this.prisma.sitepingFeedback.create({
+    return await this.prisma.beezpingFeedback.create({
       data: {
         projectName: data.projectName,
         type: data.type,
@@ -970,10 +234,10 @@ var PrismaStore = class {
         screenshotUrl,
         // Persisted as JSON when the model has a `screenshotRegion Json?`
         // column — same omit-when-null contract as `diagnostics` below, so
-        // hosts that haven't run `npx siteping sync` keep working.
+        // hosts that haven't run `npx beezping sync` keep working.
         ...data.screenshotRegion ? { screenshotRegion: data.screenshotRegion } : {},
         // Persisted as JSON when the model has a `diagnostics Json?` column.
-        // Hosts that haven't run `npx siteping sync` keep their schema as-is
+        // Hosts that haven't run `npx beezping sync` keep their schema as-is
         // and Prisma will throw if we pass an unknown column, so omit the
         // key entirely when diagnostics is null.
         ...data.diagnostics ? { diagnostics: data.diagnostics } : {},
@@ -1006,7 +270,7 @@ var PrismaStore = class {
           }))
         }
       },
-      include: INCLUDE_ANNOTATIONS
+      include: this.include
     });
   }
   /**
@@ -1031,12 +295,12 @@ var PrismaStore = class {
       try {
         const { url } = await this.screenshotStorage.upload(dataUrl, {
           feedbackId: clientId,
-          mimeType: "image/jpeg"
+          mimeType: screenshotMimeType(dataUrl)
         });
         return url;
       } catch (err) {
         console.warn(
-          "[siteping] screenshotStorage.upload failed \u2014 feedback will be saved without a screenshot. Wrap your storage's upload to handle this differently:",
+          "[beezping] screenshotStorage.upload failed \u2014 feedback will be saved without a screenshot. Wrap your storage's upload to handle this differently:",
           err
         );
         return null;
@@ -1045,7 +309,7 @@ var PrismaStore = class {
     if (!this.inlineFallbackWarned) {
       this.inlineFallbackWarned = true;
       console.warn(
-        "[siteping] enableScreenshot is on but no `screenshotStorage` is configured \u2014 base64 data URLs will be persisted inline on Feedback.screenshotUrl. Configure a ScreenshotStorage (S3/R2/\u2026) for production."
+        "[beezping] enableScreenshot is on but no `screenshotStorage` is configured \u2014 base64 data URLs will be persisted inline on Feedback.screenshotUrl. Configure a ScreenshotStorage (S3/R2/\u2026) for production."
       );
     }
     return dataUrl;
@@ -1056,17 +320,22 @@ var PrismaStore = class {
    * logged and swallowed: an orphaned object is preferable to a delete that
    * reports failure after the row is already gone. Inline `data:` URLs and
    * stores without a `delete` hook are skipped.
+   *
+   * Deletes run through a pool of at most {@link SCREENSHOT_DELETE_CONCURRENCY}
+   * concurrent calls: a project delete may free thousands of objects, and one
+   * socket each at once would exhaust the file descriptors of a serverless
+   * function, orphaning most of them.
    */
   async discardScreenshots(urls) {
     const remove = this.screenshotStorage?.delete?.bind(this.screenshotStorage);
     if (!remove) return;
     const stored = urls.filter(isStoredScreenshotUrl);
     if (stored.length === 0) return;
-    const results = await Promise.allSettled(stored.map((url) => remove(url)));
+    const results = await settleWithConcurrencyLimit(stored, SCREENSHOT_DELETE_CONCURRENCY, async (url) => remove(url));
     results.forEach((result, index) => {
       if (result.status === "rejected") {
         console.warn(
-          `[siteping] screenshotStorage.delete failed for ${stored[index]} \u2014 object left in place:`,
+          `[beezping] screenshotStorage.delete failed for ${stored[index]} \u2014 object left in place:`,
           result.reason
         );
       }
@@ -1075,16 +344,16 @@ var PrismaStore = class {
   /** URLs of the stored screenshots in `projectName` — only fetched when a `delete` hook can use them. */
   async storedScreenshotUrls(projectName) {
     if (!this.screenshotStorage?.delete) return [];
-    const rows = await this.prisma.sitepingFeedback.findMany({
+    const rows = await this.prisma.beezpingFeedback.findMany({
       where: { projectName, screenshotUrl: { not: null } },
       select: { screenshotUrl: true }
     });
     return rows.map((row) => row.screenshotUrl).filter(isStoredScreenshotUrl);
   }
   async findByClientId(clientId) {
-    return await this.prisma.sitepingFeedback.findUnique({
+    return await this.prisma.beezpingFeedback.findUnique({
       where: { clientId },
-      include: INCLUDE_ANNOTATIONS
+      include: this.include
     });
   }
   async getFeedbacks(query) {
@@ -1103,38 +372,83 @@ var PrismaStore = class {
       where.message = this.caseInsensitiveSearch ? { contains: search, mode: "insensitive" } : { contains: search };
     }
     if (isUnreachableOffset(skip)) {
-      return { feedbacks: [], total: await this.prisma.sitepingFeedback.count({ where }) };
+      return { feedbacks: [], total: await this.prisma.beezpingFeedback.count({ where }) };
     }
     const [feedbacks, total] = await Promise.all([
-      this.prisma.sitepingFeedback.findMany({
+      this.prisma.beezpingFeedback.findMany({
         where,
-        include: INCLUDE_ANNOTATIONS,
-        orderBy: { createdAt: "desc" },
+        include: this.include,
+        // `id` breaks createdAt ties: SQL leaves equal rows unordered, so
+        // OFFSET pages could otherwise repeat one row and skip another.
+        orderBy: [{ createdAt: "desc" }, { id: "desc" }],
         skip,
         take: limit
       }),
-      this.prisma.sitepingFeedback.count({ where })
+      this.prisma.beezpingFeedback.count({ where })
     ]);
     return { feedbacks, total };
   }
   async updateFeedback(id, data) {
     try {
-      return await this.prisma.sitepingFeedback.update({
+      return await this.prisma.beezpingFeedback.update({
         where: { id },
         data: {
           status: data.status,
           resolvedAt: data.resolvedAt
         },
-        include: INCLUDE_ANNOTATIONS
+        include: this.include
+      });
+    } catch (error) {
+      throw toStoreError(error);
+    }
+  }
+  /**
+   * Insert a comment. A replayed `clientId` returns the stored comment, looked
+   * up first so a replay never runs into the thread cap; a concurrent replay
+   * that wins the insert race surfaces as P2002 and is read back the same
+   * way. The `connect` turns a missing feedback into Prisma's P2025 on every
+   * provider, rather than each database's own foreign-key error. The cap on
+   * `client` comments is a count before the insert, so posts racing for the
+   * last free slot may overshoot it; a `team` comment skips it.
+   */
+  async insertComment(comments, feedbackId, data) {
+    const replayed = await this.findComment(comments, data.clientId);
+    if (replayed) return replayed;
+    if (data.authorRole === "client" && await comments.count({ where: { feedbackId, authorRole: "client" } }) >= MAX_COMMENTS_PER_FEEDBACK) {
+      throw new StoreLimitError(`A thread holds at most ${MAX_COMMENTS_PER_FEEDBACK} client comments`);
+    }
+    try {
+      return await comments.create({
+        data: {
+          feedback: { connect: { id: feedbackId } },
+          body: data.body,
+          authorName: data.authorName,
+          authorEmail: data.authorEmail,
+          authorRole: data.authorRole,
+          clientId: data.clientId
+        }
       });
     } catch (error) {
+      const winner = isStoreDuplicate(error) ? await this.findComment(comments, data.clientId) : null;
+      if (winner) return winner;
       throw toStoreError(error);
     }
   }
+  async findComment(comments, clientId) {
+    return await comments.findUnique({ where: { clientId } });
+  }
+  /**
+   * Delete one comment. Both ids go in one `deleteMany`, so a comment of
+   * another thread and an unknown one are the same zero-row miss.
+   */
+  async removeComment(comments, feedbackId, commentId) {
+    const { count } = await comments.deleteMany({ where: { id: commentId, feedbackId } });
+    if (count === 0) throw new StoreNotFoundError();
+  }
   async deleteFeedback(id) {
     let deleted;
     try {
-      deleted = await this.prisma.sitepingFeedback.delete({ where: { id } });
+      deleted = await this.prisma.beezpingFeedback.delete({ where: { id } });
     } catch (error) {
       throw toStoreError(error);
     }
@@ -1142,7 +456,7 @@ var PrismaStore = class {
   }
   async deleteAllFeedbacks(projectName) {
     const screenshotUrls = await this.storedScreenshotUrls(projectName);
-    await this.prisma.sitepingFeedback.deleteMany({ where: { projectName } });
+    await this.prisma.beezpingFeedback.deleteMany({ where: { projectName } });
     await this.discardScreenshots(screenshotUrls);
   }
   /**
@@ -1150,44 +464,50 @@ var PrismaStore = class {
    * Returns `true` when the record exists and matches, `false` otherwise.
    */
   async verifyProjectOwnership(id, projectName) {
-    const record = await this.prisma.sitepingFeedback.findUnique({
-      where: { id }
-      // Only need projectName for the check — skip annotations
+    const record = await this.prisma.beezpingFeedback.findUnique({
+      where: { id },
+      // Only need projectName for the check — not the annotations, nor an
+      // inline screenshot data URL or the diagnostics JSON
+      select: { projectName: true }
     });
     return record !== null && record.projectName === projectName;
   }
 };
-function createSitepingHandler2({
+function describePrismaError(error) {
+  if (hasOwn(error, "code") && error.code === "P2021") {
+    return "A Beezping table is missing. Run 'npx prisma db push' (or apply your migrations) to create it.";
+  }
+  return void 0;
+}
+function createBeezpingHandler({
   prisma,
   store: providedStore,
   screenshotStorage,
   caseInsensitiveSearch,
-  ...handlerOptions
+  describeError,
+  ...serverOptions
 }) {
   if (!providedStore && !prisma) {
-    throw new Error("[siteping] createSitepingHandler requires either `store` or `prisma`.");
+    throw new Error("[beezping] createBeezpingHandler requires either `store` or `prisma`.");
   }
   const store = providedStore ?? new PrismaStore(prisma, {
     screenshotStorage,
     ...typeof caseInsensitiveSearch === "boolean" ? { caseInsensitiveSearch } : {}
   });
-  return createSitepingHandler({ ...handlerOptions, store, describeError: actionableErrorMessage });
-}
-function isTableNotFoundError(error) {
-  return hasOwn(error, "code") && error.code === "P2021";
-}
-function actionableErrorMessage(error) {
-  if (isTableNotFoundError(error)) {
-    return "Table 'SitepingFeedback' not found. Run 'npx prisma db push' to create it.";
-  }
-  return void 0;
+  return createServerHandler({
+    ...serverOptions,
+    store,
+    describeError: (error) => describeError?.(error) ?? describePrismaError(error)
+  });
 }
 export {
   PrismaStore,
   StoreDuplicateError,
+  StoreLimitError,
   StoreNotFoundError,
   StorePersistenceError,
-  createSitepingHandler2 as createSitepingHandler,
+  StoreValueTooLongError,
+  createBeezpingHandler,
   dispatchWebhook,
   dispatchWebhooks,
   flattenAnnotation,